Skip to content

feat(pdp): enforce extraData size limits #807

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
siddharthbaleja7 wants to merge 5 commits into
base: pdpv0
Choose a base branch
from
Open

feat(pdp): enforce extraData size limits #807

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2df5243
feat(pdp): enforce extraData size limit at the service level (fixes #…
siddharthbaleja7 Nov 18, 2025
e61fbe4
Linting
siddharthbaleja7 Nov 18, 2025
b3f52e3
fix(pdp): enforce 256-byte extraData limit in delete piece and clarif…
siddharthbaleja7 Dec 4, 2025
80c75ec
refactor(pdp): consolidate extraData limits in handlers.go and add de…
siddharthbaleja7 Dec 5, 2025
317d533
Changes
siddharthbaleja7 Dec 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions pdp/handlers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,17 @@ import (
// PDPRoutePath is the base path for PDP routes
const PDPRoutePath = "/pdp"

const (
// MaxCreateDataSetExtraDataSize defines the limit for extraData size in CreateDataSet calls (4KB).
MaxCreateDataSetExtraDataSize = 4096

// MaxAddPiecesExtraDataSize defines the limit for extraData size in AddPieces calls (8KB).
MaxAddPiecesExtraDataSize = 8192

// MaxDeletePieceExtraDataSize defines the limit for extraData size in DeletePiece calls (256B).
MaxDeletePieceExtraDataSize = 256
)

// PDPService represents the service for managing data sets and pieces
type PDPService struct {
Auth
Expand Down Expand Up @@ -865,6 +876,11 @@ func (p *PDPService) handleDeleteDataSetPiece(w http.ResponseWriter, r *http.Req
http.Error(w, "Invalid extraData format (must be hex encoded)", http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxDeletePieceExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for DeletePiece (%d bytes)", len(extraDataBytes), MaxDeletePieceExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}
}

// Check if we have this piece or not
Expand Down
5 changes: 5 additions & 0 deletions pdp/handlers_add.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,6 +329,11 @@ func (p *PDPService) handleAddPieceToDataSet(w http.ResponseWriter, r *http.Requ
http.Error(w, "Invalid extraData format (must be hex encoded): "+err.Error(), http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxAddPiecesExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for AddPieces (%d bytes)", len(extraDataBytes), MaxAddPiecesExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}

// Step 4: Prepare piece information
pieceDataArray, subPieceInfoMap, subPieceCidList, err := p.transformAddPiecesRequest(ctx, serviceLabel, payload.Pieces)
Expand Down
11 changes: 11 additions & 0 deletions pdp/handlers_create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package pdp
import (
"encoding/hex"
"encoding/json"
"fmt"
"io"
"math/big"
"net/http"
Expand Down Expand Up @@ -64,6 +65,11 @@ func (p *PDPService) handleCreateDataSetAndAddPieces(w http.ResponseWriter, r *h
http.Error(w, "Invalid extraData format (must be hex encoded)", http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxAddPiecesExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for CreateDataSetAndAddPieces (%d bytes)", len(extraDataBytes), MaxAddPiecesExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}

// Check if indexing is needed by decoding the extraData
mustIndex, err := CheckIfIndexingNeededFromExtraData(extraDataBytes)
Expand Down Expand Up @@ -224,6 +230,11 @@ func (p *PDPService) handleCreateDataSet(w http.ResponseWriter, r *http.Request)
http.Error(w, "Invalid extraData format (must be hex encoded): "+err.Error(), http.StatusBadRequest)
return
}
if len(extraDataBytes) > MaxCreateDataSetExtraDataSize {
errMsg := fmt.Sprintf("extraData size (%d bytes) exceeds the maximum allowed limit for CreateDataSet (%d bytes)", len(extraDataBytes), MaxCreateDataSetExtraDataSize)
http.Error(w, errMsg, http.StatusBadRequest)
return
}

// Step 3: Get the sender address from 'eth_keys' table where role = 'pdp' limit 1
fromAddress, err := p.getSenderAddress(ctx)
Expand Down